CVE-2024-23968: (0Day) (Pwn2Own) ChargePoint Home Flex SrvrToSmSetAutoChnlListMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability
First published: Fri Jan 31 2025(Updated: )
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SrvrToSmSetAutoChnlListMsg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ChargePoint Home Flex Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23968?
CVE-2024-23968 is considered a critical vulnerability due to its potential for arbitrary code execution without authentication.
How do I fix CVE-2024-23968?
To remediate CVE-2024-23968, users should update their ChargePoint Home Flex charging stations to the latest firmware provided by ChargePoint.
Who is affected by CVE-2024-23968?
CVE-2024-23968 affects any installations of ChargePoint Home Flex charging stations that are accessible to network-adjacent attackers.
Can CVE-2024-23968 be exploited remotely?
No, CVE-2024-23968 requires network-adjacent access for exploitation, making it necessary for an attacker to be in close proximity to the device.
What type of attack can be executed using CVE-2024-23968?
CVE-2024-23968 allows attackers to execute arbitrary code on the compromised ChargePoint Home Flex charging stations.
- collector/nvd-api
- source/NVD
- agent/first-publish-date
- agent/type
- agent/description
- agent/title
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- agent/event
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1050
- alias/ZDI-CAN-23222
- alias/CVE-2024-23968
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/chargepoint
- canonical/chargepoint home flex firmware